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IN THE DRA WINGS: 

Please substitute the attached two replacement sheets showing formal Figs. 1 and 2 
as replacements for the originally filed Figs. 1 and 2. 
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REMARKS 

Upon entry of the present Amendment the Claims under consideration remain 
1-27. No Claims have been amended hereby. Formal replacement drawings are filed 
herewith. Reconsideration and withdrawal of all outstanding rejections is respectfully 
requested. The Detailed Action of 14 December 2005 will now be addressed with reference 
to the headings and any paragraph numbers therein. 

Drawings 

The drawings are objected to under 37 CFR 1 .83(a) because the drawings are 
informal and "the drawings must show every feature of the claims." 

Applicants have attached replacement sheets of formal drawings hereto. 

Regarding the Examiner's objections to the lack of every claim detail being 
shown in the drawings: 

With respect to the "pre-clustering" step of Claim 22(a), the person having 
ordinary skill in the art would reference the application as set forth at pages 11, line 15 
through page 12, where it is noted that the function can be accomplished by known means 
(page 11, lines 18-19). Further an exemplary pseudocode algorithm is provided at page 12 
along with further discussion to inform the person having ordinary skill in the art concerning 
said preclustering as a subset of a clustering function. Still further, the preclustering step is 
identified with reference to the drawings as encompassed in cluster building module 41 and 
cluster building index 45, represented in Fig. 2. 

Likewise, with respect to the "tracking" step of Claim 22(d), such a step can 
also be easily understood by one of skill in the art (without further illustration) through a 
reading of the text and knowledge in the art, and likewise may be encompassed in cluster 
building module 41 and cluster building index 45, represented in Fig. 2, and as set forth at 
page 12, lines 16-19 of the spec. 
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Therefore, Applicants respectfully urge that 1) the Examiner is incorrect in the 
assertion that the step is not shown in the drawings, and 2) assuming arguendo that the 
claimed step is not explicitly shown; there is no legal requirement for such explicit showing 
in the drawings under 35 USC §1 13 or 37 CFR §1.8 1(a) because it is not necessary for the 
understanding of the subject matter sought to be patented (when read by a person having 
ordinary skill in the art because such person of skill would necessarily understand the claim in 
view of the above cited parts of the specification as a whole). 

Claim Rejections -35 USC §103 

Applicants would first like to reiterate an overall view of the invention by 

reference to the Abstract of the Invention at page 35 of the specification. 

The present invention relates to a system for detecting misuse of 
authorized access to a digital data gathering system by a user. User behavior 
is monitored as to the search queries, the search results, or both. When a 
valid record of normal user behavior is obtained, each new query and result 
for the user can be compared to the record to determine if anomalous activity 
has occurred. 

It is respectfully urged that none of the cited references teach or suggest these 
techniques of the present invention. Thus, rather than taking the §103 rejections of 
paragraphs Il-Xn in order, in certain instances the discussion below may be grouped where 
the same references are used in the rejections. 

Per paragraph H, page 3, of the Detailed Action, Claims 1,2 7 and 14 stand 
rejected as obvious over Lermuzeaux et aL (U.S. Patent 5,62 1 ,889, hereinafter Lermuzeaux) 
in view of Oblinger, US Pub. No. 2002/0107852. It is the contention of the Detailed Action 
that Lermuzeaux substantially teaches or suggests the presently claimed invention except for 
clustering data (Claim 1) and structured data profiles (Claim 7), which is shown by Oblinger. 
Applicants traverse. 

Lermuzeaux is cited to demonstrate that security systems exist, which is true 



nT-171 



4 



RWN/pc 



Serial No.: 09/929,094 

per scy but not what is being claimed within the invention as a whole. The reference 
demonstrates that user behavior monitoring to support anomaly detection is known, which is 
true per se^ but not what is being claimed. Lermuzeaux's general approach is designed to 
detect non-authorized uses and is a "rule based" system for detecting behavior differences 
with respect to system operation. It is relevant to the present invention only to demonstrate 
that the present invention is not the first user difference security system, which again is true 
per se but not what is being claimed. 

A primary difference between Lermuzeaux. and the present invention is that 
they are two different types of security systems. That is, the present invention is information 
or data retrieval-based system to detect information content differences in a user's 
information retrieval patterns and content misuse, rather than based upon user action 
differences as in Lermuzeaux. In short, Lermuzeaux provides no suggestion for a security 
system based on information retrieval patterns. 

Oblinger is cited to demonstrate that data clustering has existed, which is true 
perse^ but not what is being claimed within the invention as a whole. There is no mention of 
security uses throughout the entire Oblinger application. 

No mention comes from either reference to supply motivation for practicing 
the limitations of monitoring families of the digital data gathering results of the user; 
comparing the families of the digital data gathering results of the user to the user cluster index 
to determine anomalies in the digital data gathering results; and identifying a potential misuse 
as set forth in the substance of independent Claims 1 and 14. 

Thus, no motivation comes from the art itself to combine Oblinger and 
Lermuzeaux. to achieve the present invention. Therefore, no prima facie case of obviousness 
can be made from these references with respect to the claimed inventions. It is respectfully 
requested that the present rejections be reconsidered and withdrawn. 

It is also noted that the reference to Lermuzeaux, col, 7, lines 9-25, in the 
Detailed Action does not appear to be congruent with the teachings it is said to illustrate. 
Clarification is requested in a second non-final action should this rejection be maintained. 
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Per paragraph HI, page 6, of the Detailed Action, Claims 3-6 and 9 stand 
rejected as obvious over Lermuzeaux and Oblinger, and further in view of Lane et al.. 
Temporal Sequence Learning and Data Reduction for Anomaly Detection (hereinafter 
"Lane"). 

Lane is cited to demonstrate that user profiles based on terms (in this case 
systems commands and especially Unix shell examples) existed. Again, this is true per se, 
but not what is being claimed within the invention as a whole. As noted at page 5, line 1 of 
the specification, the present invention is concemed with the application level. At this level 
the commands are minimal in variance, e.g., "search terml term2" does not differ "search 
term3 term4"; as opposed to Unix commands, upon which Lane is based, where variance is 
much greater. The Examiner contends that Lane refers to "phrases" & "queries." However, 
the Applicant's review of the reference did not find these terms used in the publication, 
especially as used within the context of the present invention. The lack of use of these terms 
is to be expected as the Lane reference's teaching is basically for operating systems intrusion 
detection. Lane is merely one example of many systems-oriented detection systems. 

The present invention is not an intrusion detection system per se, it is geared 
for detecting authorized misuse. Per the above discussion with respect to Lermuzeaux and 
Oblinger, it is urged that Lane does not add any suggestion with respect to motivation for 
practicing the limitations of monitoring families of the digital data gathering results of the 
user; comparing the families of the digital data gathering results of the user to the user cluster 
index to determine anomalies in the digital data gathering results; and identifying a potential 
misuse as set forth in the substance of independent Claim 1 . 

Thus, no motivation comes from the art itself to achieve the present invention. 
Therefore, no prima facie case of obviousness can be made fi"om these references with respect 
to the claimed inventions. It is respectfully requested that the present rejections be 
reconsidered and withdrawn. 

Per paragraph Vn, page 12, of the Detailed Action, Claims 15-21 stand 
rejected as obvious over Lermuzeaux, Oblinger and Lane, Applicants traverse. 
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As discussed above, none of the cited references teach or suggest the use of 
information retrieval, including a user lexicon, user cluster index and structured data profile 
of user characteristics to detect misuse per the limitations of independent Claim 15, the ratio 
of anomalies per Claim 16, etc., based on monitoring of information retrieval patterns. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectfully requested that the present rejections 
be reconsidered and withdrawn. 

Per paragraph IV, page 8, of the Detailed Action, Claim 8 stands rejected as 
obvious over Lermuzeaux and Oblinger, and further in view of Parker et al., US Patent No. 
5,909,589 (hereinafter "Parker"). 

Parker is cited to demonstrate that it is possible to identify a user by 
verification against a structured data profile, which while again true per se, is not what is 
being claimed within the invention as a whole. Parker teaches detecting user habits, such as 
typing errors, mouse click patterns, etc, namely user interaction; rather than information 
systems content returned to the user as in the present invention. 

Furthermore, the present invention monitors a lexicon, namely a vocabulary, 
of returned results from search queries from documents retrieved; and not user identity 
detection questions as taught in Parker. Parker is relevant largely to intrusion detection rather 
than misuse as in the present invention which assumes the users are valid users. While the 
level of relevance of Parker is marginal in that it is about security, Parker does not teach or 
suggest the monitoring of a structured data profile or other limitations as identified above 
with respect to Lermuzeaux and Oblinger, within the context of the present invention. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectfully requested that the present rejections 
be reconsidered and withdrawn. 
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Per paragraph V, page 9, of the Detailed Action, Claims 10-12 stands rejected 
as obvious over Parker in view of Lane. Applicants traverse. 

Per the above discussions, neither of Parker or Lane teach or suggest the 
limitations for practicing the limitations of monitoring the digital data gathering results of the 
user; constructing and maintaining a user lexicon and the use of same to detect a potential 
misuse. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectfiilly requested that the present rejections 
be reconsidered and withdrawn. 

Per paragraph VI, page 1 1, of the Detailed Action, Claim 13 stands rejected as 
obvious Parker and Lane in view of Lermuzeaux. Applicants traverse. 

Parker probes the user for identifying information that only the user would 
know; as in Parker (col. 11 lines 40-42: where "the student is probed with questions to 
identify his or her identity), which the present invention does not do. Rather the statistics the 
present invention maintains in a structured repository are details about the user, (such as 
hours of employment, vacation schedule, security clearance, etc.,) used by the application to 
verify content correctness. Per the above discussions, none of Parker, Lane or Lermuzeaux 
teach or suggest the limitations for practicing the monitoring the digital data gathering results 
of the user; constructing and maintaining a list of data identifying workplace characteristics of 
the user and the use of same to detect a potential misuse. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectfully requested that the present rejections 
be reconsidered and withdrawn. 
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Per paragraph Vin, page 16, of the Detailed Action, Claim 22 stands rejected 
as obvious over Herz et al., U.S. Patent 5,835, 087 (hereinafter "Herz") in view of Lane. 

Per paragraph X, page 1 8, of the Detailed Action, Claims 24-25 stand rejected 
as obvious over Lane view of Herz. Applicants traverse. 

Herz is drawn to what is commonly referred to today as document routing. 
While Herz may be used to show that clustering is used in information retrieval, which again 
is true per se, Herz has nothing to do with security measures and provides no motivation to 
combine its techniques with a security system to achieve the present invention as a whole.. 
Nor does Lane supply the missing teachings or motivation for such a combination. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectfixUy requested that the present rejections 
be reconsidered and withdrawn. 

Per paragraph XI, page 1 9 of the Detailed Action, Claim 26 stands rejected as 
obvious over Oblinger in view of Lane. 

Per paragraph Xn, page 20 of the Detailed Action, Claim 27 stands rejected as 
obvious over Oblinger and Herz in view of Lane. Applicants traverse. 

Per the above discussion, none of Oblinger, Herz and Lane teach a system of 
monitoring an information retrieval system, in the present claims a document collection, for 
the purposes of maintaining a lexicon and predicting misuse, according to the present 
invention as a whole. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these references 
with respect to the claimed inventions. It is respectftilly requested that the present rejections 
be reconsidered and withdrawn. 
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Per paragraph IX, page 1 7 of the Detailed Action, Claim 23 stands rejected as 
obvious over Lane in view of Zhang et al., US Patent 5,832,182 (hereinafter "Zhang"). 
Applicants traverse. 

Zhang is drawn to data clustering and is cited to show that one can keep a 
count on the number of items in a cluster and to make sure to assign the data to the right 
cluster. While again, this may be true per se, the Zhang patent has nothing to do with, and 
provides no suggestion for, a security system based on information retrieval; and therefore 
provides no motivation to combine with Lane to suggest the elements of the present invention 
when viewed as a whole. 

Thus, no motivation comes from the cited art itself to achieve the present 
invention. Therefore, no prima facie case of obviousness can be made from these two 
references with respect to the claimed inventions. It is respectfiilly requested that the present 
rejections be reconsidered and withdrawn. 

Conclusion 

The cited references do not provide a suggestion of combinability, or a 
likelihood of success, for a combination which teaches or suggests the presently claimed 
invention(s). When the present claims are viewed as a whole and not as a template to pick 
and chose those sections of the cited art which meet the fimctionahty of individual 
limitations, it is respectfully urged that the teachings of the present references do not create a 
prima facie case of obviousness and the present rejections must be withdrawn. 

For all the foregoing reasons, the Claims under consideration are believed to 
be allowable over the art of record. A notice to that effect is earnestly solicited. 

Examiner Interview Summary 
Applicants' undersigned Attorney and Examiner Khooshnoodi conducted a 
telephonic interview of this case on 23 February 2006. Each of the cited references was 
generally discussed with respect to the present claims. The drawing objections were also 
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discussed. No agreement was reached as to the allowance of any claims. The Examiner 
indicated that the drawings, upon further consideration, were likely to be acceptable. 
Applicants' attorney wishes to thank the Examiner for the courtesy shown him during their 
interview. 

Request for Telephonic hiterview 
The Examiner is further requested to call Applicants' attorneys should the 
Examiner feel that any issues remain after entry and consideration of the present paper. 



Pauley Petersen & Erickson 
2800 West Higgins Road; Suite 365 
Ho fftnan Estates, Illinois 60195 
TEL (847) 490-1400 
FAX (847) 490-1403 



Favorable consideration is requested. 



Respectfully submitted, 




Roland W. Norris 
Registration No. 32,799 
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